up vote 2 down vote favorite
1
share [g+] share [fb]

What's to stop somebody from creating a setuid-root script on a flash drive, then putting it into another person's computer and getting root access? I assume there's some kind of protection against that, but I don't have a spare drive to test with.

link|improve this question
Are you just interested in scripts, as your question implies, or do you want information on similar types of apparent attacks? If just scripts, why? If not, could you please clarify your question? – Daniel Aug 14 '11 at 6:38
feedback

1 Answer

up vote 5 down vote

If a volume is mounted nosuid then the setuid bit is ignored on executables. At least newer versions of Fedora mount external media with this option.

Also, setuid does nothing for scripts unless the interpreter is prepared to run a separate copy of the interpreter as the user in question. Not many are.

link|improve this answer
1  
The script/suid issue isn't that big - you can always right a simple C program that just executes the shell. – Daniel Aug 14 '11 at 6:18
@Daniel: Sure, but that's out of scope for this question. – Ignacio Vazquez-Abrams Aug 14 '11 at 6:19
… and the nosuid option would stop that binary from employing set-UID, too. – JdeBP Aug 15 '11 at 0:50
Interpreters won't get a choice in the matter of whether a separate process is run or not if the script is executable and employs #!, by the way. – JdeBP Aug 15 '11 at 0:55
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.